Schema Law Security: What the Site Says and Does Not Say

Schema Law security rests on four published commitments: no model training on your documents, documents kept inside your own account, encryption in transit and at rest, and deletion whenever you choose. The site names no certification, audit or processing location. Whether that is enough for a client file is your call, and this post gives you the wording.

Everything here comes from two public pages, the homepage and the pricing page. This post adds nothing to them. It is a reading aid for a lawyer or paralegal who has to write a vendor note for the file, and it is not legal advice.

Is Schema Law safe for client documents?

Nobody can answer "is Schema Law safe" for you, because safe depends on the document, the client and your professional rules. What can be said is narrower. The site makes four written commitments on every plan, adds one Enterprise line about a security review, and is silent on several things a security review asks about.

That gives you three piles to sort.

A worked example. Priya Raman is a solo practitioner with a scanned commercial lease to convert for a tenant client. She reads the four commitments, pastes them into the matter's vendor note, checks the client's engagement terms for any limit on outside services, and sends the company her remaining questions in writing. She uploads once the reply is in the file. Her rules may ask for more or less than that. The record shows what she relied on.

A statement on a website is the vendor's own account of itself. This post does not test, audit or verify any of it.

Frame the vendor note around the duty of competence: what you read, what you asked, and what you still do not know. Client confidentiality is why the document class sits in that note beside the copied wording. Put open information security questions, including any breach notification term the pages omit, in the email you send before a first upload.

The four Schema Law security commitments, word for word

The pricing page lists four commitments that apply to every plan, the Free plan included: "Your documents are never used to train an AI model", "Documents stay inside your own account", "Encrypted in transit and at rest", and "Delete any document, at any time". The security section of the homepage restates each one with a sentence of explanation.

The questions section repeats the first commitment in answer to a direct question: "Documents you upload are used only to produce your export. They are never used to train or improve any model."

Read each line for what it covers and where it stops.

• Training. The wording is "never", and it reaches "anyone else's" model. It is a promise about use. It does not describe how pages are read.
• Closed system. The promise is about other customers and the public. It does not say which people at the company can open a file. The post on whether an OCR vendor's employees can see your documents explains why that is a separate question.
• Encryption. Two states are named, in transit and stored. No algorithm, key length or key holder is given.
• Deletion. The original and "everything parsed from it" are covered. The line does not mention backups, logs or a time frame.

Which Schema Law security terms change with the plan?

Only one security term changes with the plan: the Enterprise list adds "Security questionnaire and contract review". Every plan runs the same software, and the four commitments do not change. The pricing page lists them once, under the words "On every plan, free included". The rest of each plan list is price, page allowance and support.

No plan list has a line about how long documents are kept, and none describes documents being removed on a schedule. The only statement on the subject is the homepage commitment quoted above, which leaves deletion to you on every plan. The post on whether OCR software stores your documents explains what to ask a vendor about copies that outlast a deletion.

Two points about the Enterprise line. "Security questionnaire and contract review" is the one line on the site that points to a negotiated document. The plan summary reads: "For firms with their own security review and volume to match." If your firm's policy requires a signed agreement with security terms before client files leave the building, that line is where the conversation starts. And the plan list does not say whether the other plans can get the same review, so ask.

What the Schema Law site does not state about security

The Schema Law site states no certification, no audit report, no processing or storage location, no list of the companies or models involved in reading a page, and no rules on staff access. Treat each as unknown. Silence is not a yes and it is not a no.

Topics on which the homepage and the pricing page say nothing:

• Any certification, attestation, audit or compliance with a named standard or statute. The site claims none. Do not read one into the four commitments or into this post.
• The country or region where uploads are handled or kept. The post on OCR data residency explains how to put that question to a vendor.
• Which other companies, if any, take part in processing.
• Who inside the company can open a document, and under what conditions.
• Access logs you can review.
• Breach notification terms, or a time limit for notice.
• Backups, and how long deleted material stays in them.
• Sign-in controls, such as a second verification step.
• A published data processing agreement or security white paper.

If your client, your insurer or a protective order requires any item on this list, the public pages will not satisfy it. A written answer from the company might. A missing answer is a reason to keep that document off the service.

Questions to send Schema Law before a first confidential upload

Send your questions in writing before the first confidential upload, and keep the reply with the matter or with your firm's vendor records. Ask about what the site leaves unstated, and ask which document makes each commitment binding on your plan.

1. Which document makes the four commitments binding for my plan, and how will I learn of a change?
2. The pricing page says the commitments apply on every plan, "free included". Do they also apply during any trial or pilot?
3. In which country or countries are my uploads processed and stored?
4. Does any other company receive my documents or the text taken from them? If so, on what terms?
5. Which of your staff can open a customer's document, for what reasons, and is each access recorded?
6. When I delete a document, are copies in backups and logs removed as well, and within what period?
7. Is a document ever removed without my deleting it, for example when an account is closed or a plan changes?
8. If you learn of unauthorized access to my documents, when and how will you tell me?
9. Can a plan other than Enterprise go through a security questionnaire or contract review?

Before you send them, save a dated PDF of the homepage and the pricing page. Pages change, and your note should show what the wording was on the day you relied on it.

When the reply arrives, compare it with the homepage line by line. An answer that is narrower than the published commitment, or that leaves a question out, tells you something. Then decide which documents the answers support, and set a date to ask again.